kclient: make statfs() cleanup when interrupted

Statfs() needs to remove itself from the request tree when
completed or canceled.  Otherwise, we end up with request
pointers to bad locations on the stack.  Fixes crash from
dbench after control-c.

diff --git a/src/kernel/mon_client.c b/src/kernel/mon_client.c
index 7b67a5aa257ddccf297c41168a72d96ef437e505..3b18c2d9e47a0256517bd8451852259044aac417 100644 (file)
--- a/src/kernel/mon_client.c
+++ b/src/kernel/mon_client.c
@@ -295,10 +295,6 @@ void ceph_monc_handle_statfs_reply(struct ceph_mon_client *monc,
        mutex_lock(&monc->statfs_mutex);
        req = radix_tree_lookup(&monc->statfs_request_tree, tid);
        if (req) {
-               radix_tree_delete(&monc->statfs_request_tree, tid);
-               monc->num_statfs_requests--;
-               if (monc->num_statfs_requests == 0)
-                       cancel_delayed_work(&monc->statfs_delayed_work);
                req->buf->f_total = reply->st.f_total;
                req->buf->f_free = reply->st.f_free;
                req->buf->f_avail = reply->st.f_avail;
@@ -367,6 +363,14 @@ int ceph_monc_do_statfs(struct ceph_mon_client *monc, struct ceph_statfs *buf)
        if (err)
                return err;
        err = wait_for_completion_interruptible(&req.completion);
+
+       mutex_lock(&monc->statfs_mutex);
+       radix_tree_delete(&monc->statfs_request_tree, req.tid);
+       monc->num_statfs_requests--;
+       if (monc->num_statfs_requests == 0)
+               cancel_delayed_work(&monc->statfs_delayed_work);
+       mutex_unlock(&monc->statfs_mutex);
+
        if (err == -EINTR)
                return err;
        return req.result;